Add persistent NIP-07 permission manager and profile controls

shadowbipnode · shadowbipnode · commit 3bf2040dedd0 · 2026-05-11T14:58:47.000+02:00
diff --git a/src/main/db.js b/src/main/db.js
@@ -82,6 +82,17 @@ function init() {
       active           INTEGER NOT NULL DEFAULT 1,
       created_at       INTEGER NOT NULL
     );
+    
+    CREATE TABLE IF NOT EXISTS nostr_permissions (
+      id         INTEGER PRIMARY KEY AUTOINCREMENT,
+      origin     TEXT    NOT NULL,
+      action     TEXT    NOT NULL,
+      decision   TEXT    NOT NULL,
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL,
+      UNIQUE(origin, action)
+    );
+
 
     CREATE TABLE IF NOT EXISTS privacy_settings (
       id             INTEGER PRIMARY KEY,
@@ -176,12 +187,47 @@ function clearHistory() {
   return { ok: true }
 }
 
+// ── Nostr permissions ─────────────────────────────────────────────────────────
+function getNostrPermission(origin, action) {
+  return db
+    .prepare('SELECT decision FROM nostr_permissions WHERE origin=? AND action=?')
+    .get(origin, action) || null
+}
+
+function setNostrPermission(origin, action, decision) {
+  const ts = now()
+
+  db.prepare(`
+    INSERT INTO nostr_permissions(origin, action, decision, created_at, updated_at)
+    VALUES (?, ?, ?, ?, ?)
+    ON CONFLICT(origin, action)
+    DO UPDATE SET decision=excluded.decision, updated_at=excluded.updated_at
+  `).run(origin, action, decision, ts, ts)
+
+  return { origin, action, decision }
+}
+
+function listNostrPermissions() {
+  return db
+    .prepare('SELECT origin, action, decision, updated_at FROM nostr_permissions ORDER BY updated_at DESC')
+    .all()
+}
+
+function removeNostrPermission(origin, action) {
+  db
+    .prepare('DELETE FROM nostr_permissions WHERE origin=? AND action=?')
+    .run(origin, action)
+
+  return { ok: true }
+}
+
 module.exports = {
   init,
   getSetting, setSetting,
   getPrivacy, setPrivacy,
   getFavorites, addFavorite, removeFavorite,
   addHistory, getHistory, clearHistory,
   cashuGetBalance, cashuListMints, cashuAddMint, cashuRemoveMint,
+  getNostrPermission, setNostrPermission, listNostrPermissions, removeNostrPermission,
   _db: () => db,
 }
diff --git a/src/main/index.js b/src/main/index.js
@@ -1,5 +1,5 @@
 'use strict'
-const { app, BrowserWindow, BrowserView, ipcMain, session } = require('electron')
+const { app, BrowserWindow, BrowserView, ipcMain, session, dialog } = require('electron')
 const path   = require('path')
 const DB     = require('./db')
 const wallet = require('./wallet')
@@ -28,6 +28,80 @@ const UA_POOL = [
   'Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36',
 ]
 let currentUA = UA_POOL[Math.floor(Math.random() * UA_POOL.length)]
+const nostrPermissions = new Map()
+
+function getIpcOrigin(ipcEvent) {
+  const url =
+    ipcEvent.senderFrame?.url ||
+    ipcEvent.sender?.getURL?.() ||
+    ''
+
+  try {
+    return new URL(url).origin
+  } catch (_) {
+    return 'unknown-origin'
+  }
+}
+
+function summarizeNostrEvent(event) {
+  if (!event || typeof event !== 'object') {
+    return 'Unknown event'
+  }
+
+  const kind = event.kind ?? 'unknown'
+  const content = typeof event.content === 'string' ? event.content : ''
+  const tags = Array.isArray(event.tags) ? event.tags.length : 0
+
+  return [
+    `Kind: ${kind}`,
+    `Content length: ${content.length} chars`,
+    `Tags: ${tags}`,
+  ].join('\n')
+}
+
+async function confirmNostrPermission(ipcEvent, action, nostrEvent) {
+  const origin = getIpcOrigin(ipcEvent)
+
+  const stored = DB.getNostrPermission(origin, action)
+
+  if (stored?.decision === 'allow') {
+    return true
+  }
+
+  if (stored?.decision === 'deny') {
+    return false
+  }
+
+  const result = await dialog.showMessageBox(mainWindow, {
+    type: 'question',
+    title: 'Nostr signing request',
+    message: 'A website is requesting access to your Nostr identity.',
+    detail: [
+      `Origin: ${origin}`,
+      `Action: ${action}`,
+      '',
+      summarizeNostrEvent(nostrEvent),
+      '',
+      'Only approve this request if you trust this website.',
+    ].join('\n'),
+    buttons: ['Allow once', 'Always allow', 'Always deny', 'Deny once'],
+    defaultId: 0,
+    cancelId: 3,
+    noLink: true,
+  })
+
+  if (result.response === 1) {
+    DB.setNostrPermission(origin, action, 'allow')
+    return true
+  }
+
+  if (result.response === 2) {
+    DB.setNostrPermission(origin, action, 'deny')
+    return false
+  }
+
+  return result.response === 0
+}
 
 function createMainView() {
   const view = new BrowserView({
@@ -358,12 +432,25 @@ ipcMain.handle('nostr-import-nsec',    (_, args) => nostr.importNsec(DB, args))
 ipcMain.handle('nostr-skip',           () => DB.setSetting('nostr_skipped', '1'))
 ipcMain.handle('nostr-get-profile',    () => nostr.getProfile(DB))
 ipcMain.handle('nostr-remove-profile', () => nostr.removeProfile(DB))
+ipcMain.handle('nostr-list-permissions', () => DB.listNostrPermissions())
+ipcMain.handle('nostr-remove-permission', (_, { origin, action }) => {
+  if (!origin || !action) throw new Error('Invalid permission')
+  return DB.removeNostrPermission(origin, action)
+})
 ipcMain.handle('nostr-get-relays',     () => nostr.getRelays())
 ipcMain.handle('nostr-sign-event',     (_, { event }) => nostr.signEvent(DB, event))
 ipcMain.handle('nostr-get-pubkey',     () => nostr.getPubkey(DB))
 // NIP-07 aliases — same implementation, separate IPC channels for clarity
 ipcMain.handle('nostr-get-pubkey-nip07',  () => nostr.getPubkey(DB))
-ipcMain.handle('nostr-sign-event-nip07',  (_, { event: e }) => nostr.signEvent(DB, e))
+ipcMain.handle('nostr-sign-event-nip07', async (ipcEvent, { event: e }) => {
+  const allowed = await confirmNostrPermission(ipcEvent, 'signEvent', e)
+
+  if (!allowed) {
+    throw new Error('Nostr signing request denied by user')
+  }
+
+  return nostr.signEvent(DB, e)
+})
 ipcMain.handle('nostr-get-relays-nip07',  () => nostr.getRelays())
 ipcMain.handle('nostr-nip04-encrypt', async (_, { pubkey, text }) => {
   const { nip04 } = require('nostr-tools')
diff --git a/src/preload/shell.js b/src/preload/shell.js
@@ -40,12 +40,15 @@ contextBridge.exposeInMainWorld('zap', {
   validateMnemonic: (a) => ipcRenderer.invoke('validate-mnemonic', a),
   setupWallet:      (a) => ipcRenderer.invoke('setup-wallet', a),
 
-  // Nostr
+ // Nostr
   nostrCreateProfile: (a) => ipcRenderer.invoke('nostr-create-profile', a),
   nostrImportNsec:    (a) => ipcRenderer.invoke('nostr-import-nsec', a),
   nostrSkip:          () => ipcRenderer.invoke('nostr-skip'),
   nostrGetProfile:    () => ipcRenderer.invoke('nostr-get-profile'),
   nostrRemoveProfile: () => ipcRenderer.invoke('nostr-remove-profile'),
+  nostrListPermissions: () => ipcRenderer.invoke('nostr-list-permissions'),
+  nostrRemovePermission: (a) =>
+    ipcRenderer.invoke('nostr-remove-permission', a),
   nostrGetRelays:     () => ipcRenderer.invoke('nostr-get-relays'),
   nostrSignEvent:     (a) => ipcRenderer.invoke('nostr-sign-event', a),
   nostrGetPubkey:     () => ipcRenderer.invoke('nostr-get-pubkey'),
diff --git a/src/renderer/components/nostr/NostrPanel.tsx b/src/renderer/components/nostr/NostrPanel.tsx
@@ -10,6 +10,7 @@ interface Profile {
 export default function NostrPanel({ onClose }: { onClose:()=>void }) {
   const [profile, setProfile] = useState<Profile|null>(null)
   const [relays,  setRelays]  = useState<string[]>([])
+  const [permissions, setPermissions] = useState<any[]>([])
   const [showImport, setShowImport] = useState(false)
   const [nsec, setNsec] = useState('')
   const [name, setName] = useState('')
@@ -21,6 +22,8 @@ export default function NostrPanel({ onClose }: { onClose:()=>void }) {
     setProfile(p || null)
     const r = await window.zap?.nostrGetRelays()
     setRelays(Object.keys(r || {}))
+    const perms = await window.zap?.nostrListPermissions()
+    setPermissions(perms || [])
   }
 
   useEffect(() => {
@@ -76,6 +79,20 @@ export default function NostrPanel({ onClose }: { onClose:()=>void }) {
     }
   }
 
+  const revokePermission = async (origin: string, action: string) => {
+    setBusy(true)
+    setError('')
+
+    try {
+      await window.zap?.nostrRemovePermission({ origin, action })
+      await load()
+    } catch (err: any) {
+      setError(err?.message || 'Failed to revoke permission.')
+    } finally {
+      setBusy(false)
+    }
+  }
+
   return (
     <>
       <div className="panel-hd">
@@ -177,7 +194,75 @@ export default function NostrPanel({ onClose }: { onClose:()=>void }) {
             >
               📋 Copia pubkey
             </button>
+            <div style={{
+              marginTop:16,
+              padding:12,
+              background:'var(--bg-3)',
+              border:'1px solid var(--b0)',
+              borderRadius:'var(--r-md)',
+            }}>
+              <div className="sec-title" style={{ marginBottom:10 }}>
+                NIP-07 Permissions
+              </div>
+
+              {permissions.length === 0 ? (
+                <div style={{
+                  fontSize:11.5,
+                  color:'var(--t2)',
+                  lineHeight:1.5,
+                }}>
+                  No stored permissions yet.
+                </div>
+              ) : (
+                permissions.map((perm, idx) => (
+                  <div
+                    key={`${perm.origin}-${perm.action}-${idx}`}
+                    style={{
+                      padding:'10px 0',
+                      borderBottom:
+                        idx !== permissions.length - 1
+                          ? '1px solid var(--b0)'
+                          : 'none',
+                    }}
+                  >
+                    <div style={{
+                      fontSize:12,
+                      fontWeight:700,
+                      color:'var(--t0)',
+                      marginBottom:3,
+                      wordBreak:'break-all',
+                    }}>
+                      {perm.origin}
+                    </div>
+
+                    <div style={{
+                      fontSize:11,
+                      color:'var(--t2)',
+                      marginBottom:8,
+                    }}>
+                      {perm.action} — {perm.decision}
+                    </div>
 
+                    <button
+                      style={{
+                        padding:'6px 10px',
+                        border:'1px solid #7f1d1d',
+                        background:'rgba(127,29,29,.15)',
+                        color:'#fca5a5',
+                        borderRadius:'var(--r-sm)',
+                        cursor:'pointer',
+                        fontSize:11,
+                      }}
+                      onClick={() =>
+                        revokePermission(perm.origin, perm.action)
+                      }
+                    >
+                      Revoke
+                    </button>
+                  </div>
+                ))
+              )}
+            </div>
             <button
               style={{
                 width:'100%',
